Cofense Vision

The Cofense Vision integration provides commands to initiate advanced search jobs to hunt suspicious emails matching IOCs. It also contains commands to quarantine emails, download messages and their attachments, and aids to manage IOCs in the local repository to keep up with upcoming emerging threats.

Data Enrichment & Threat Intelligence · Cofense Vision

Configuration parameters

  • url — Server URL (required)
  • credentials — Client ID (required)
  • threat_levels_good — Threat levels to be marked as Good
  • threat_levels_suspicious — Threat levels to be marked as Suspicious
  • threat_levels_bad — Threat levels to be marked as Bad
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (22)

  • cofense-ioc-delete

    Deletes a single active or expired IOC from the local IOC Repository.

  • cofense-ioc-get

    Retrieves the IOC identified by its unique MD5 ID.

  • cofense-ioc-update

    Updates the IOC identified by its unique MD5 ID.

  • cofense-iocs-list

    Lists the IOCs stored in the local IOC Repository.

  • cofense-iocs-update

    Updates one or more IOCs stored in the local IOC repository. To update multiple IOCs use iocs_json argument. Note: iocs_json parameter will take precedence over other parameters. threat_type, threat_value, threat_level, created_at and source_id are required parameters to update a single IOC.

  • cofense-last-ioc-get

    Synchronizes the update of data between the IOC source and the IOC repository. Retrieves the last updated IOC from the local IOC Repository. It may return an active or an expired IOC.

  • cofense-message-attachment-get

    Fetches the full content of an email and returns a zip file.

  • cofense-message-get

    Fetches full content of an email and returns it as a zip file using a token.

  • cofense-message-metadata-get

    Retrieves the full content of a message that matches the specified Internet message ID and recipient email address of an email.

  • cofense-message-search-create

    Creates a new search.

  • cofense-message-search-get

    Retrieves the result of the search identified by an ID.

  • cofense-message-search-results-get

    Retrieves the results for the search identified by the search ID.

  • cofense-message-searches-list

    Retrieves the list of searches.

  • cofense-message-token-get

    Retrieves a one-time token that can be used to get an email's content.

  • cofense-quarantine-job-approve

    Approves the quarantine job identified by its unique ID. When the "Auto Quarantine" feature is configured which requires manual approvals, this command can approve all the pending quarantine jobs.

  • cofense-quarantine-job-create

    Creates a new quarantine job.

  • cofense-quarantine-job-delete

    Deletes the quarantine job identified by its unique ID.

  • cofense-quarantine-job-get

    Retrieves quarantine job identified by its unique ID.

  • cofense-quarantine-job-restore

    Restores emails quarantined by the job identified by its unique ID.

  • cofense-quarantine-job-stop

    Issues a request to stop the quarantine job identified by its unique ID.

  • cofense-quarantine-jobs-list

    Filters and returns a paginated list of matching quarantine jobs.

  • cofense-searchable-headers-list

    Retrieves a list of configured header keys that can be used to create a message search.